As more users are connected to the Internet and conduct their daily activities electronically, computer users have become the target of an underground economy that infects hosts with malicious software, also known as malware, mainly for financial gain. Unfortunately, even a single visit to an infected web site enables the attacker to detect vulnerabilities in the user's browser and to allow malware to infect the user's computer. Frequently, this malware allows the adversary to gain access to confidential data or even full control of the compromised terminal devices, leading to the ex-filtration of sensitive information or installation of utilities that facilitate remote control of the host.
Internet services are increasingly becoming an essential part of our everyday life. We rely more and more on the convenience and flexibility of Internet-connected devices to communicate and, in general, to perform tasks that would otherwise require our physical presence, such as banking tasks. Although very beneficial, Internet transactions can expose user sensitive information. Banking and medical records, authorization passwords and personal communication records can easily become known to an adversary who can successfully compromise any of the devices that are connected.
In most cases, a successful exploit results in infection by malware which installs itself on the user's computer (or any other user's terminal device that connects to a data network such as the Internet). Malware can be used to steal sensitive information such as banking passwords, especially when the user activates his browser.
To address this problem efficient malware detection tools are required.
US 2011/0239300 having the same applicant discloses a method for detecting HTML-modifying malware present in a computer. A determination is made whether a modified string exists in the web page received by a browser. Malware is determined to be present in the computer if a modifying element is found, whereupon one or more alerting or preventing tasks may be generated. US 2011/0239300, the contents of which is incorporated herein by reference, provides a remote server that comprises a malware scanning engine for scanning a webpage displayed by the user's browser over a network. The malware scanning engine is adapted to detect changes in the displayed webpage which are indicative of the presence of malware injected in the user's terminal. However, in case when a user accesses the server with a browser which is not “supported” by the malware (i.e., the malware has not been written to attack this type of browser), the user's computer will not be detected as infected with the malware. Also, the method proposed by US 2011/0239300 can detect malware only when the user is connected to a website.
It is therefore an object of the present invention to provide a client side malware detection method.
Other objects and advantages of the invention will become apparent as the description proceeds.